How much does CMMC Level 2 certification cost?

DoD's own estimate in the CMMC Program final rule is $104,670 over three years for a small entity and $117,768 for other than small (89 FR 83178 (Tables 9 and 10)), covering planning, the assessment itself including the C3PAO fee, reporting and three annual affirmations. That figure deliberately excludes the cost of implementing NIST SP 800-171, which the rule treats as an existing DFARS 252.204-7012 obligation; the estimator above adds that part from your own open requirements.

How much does a Level 2 self-assessment cost?

$37,196 over three years for a small entity and $48,827 for other than small, per the same tables. Since the suspension of CMMC Phase II on 13 July 2026, the self-assessment is the Level 2 path contracting officers can require today.

Why do other CMMC cost calculators ask for my email before showing a number?

Because the number is the thing they are selling. Ours shows the range on the page and emails the line items, the hours, the rates and the sources; you can check every figure against the Federal Register.

Is a CUI enclave cheaper than treating the whole company as in scope?

Usually, and the estimator shows why rather than asserting a percentage: a managed enclave carries the technical control families (access, audit, configuration, identification, media, communications and integrity protection) as inherited or system-enforced controls, so the hours you still spend are on the policy and people requirements. The enclave path prices MacTech's packages at today's catalog prices beside the in-house path so you can compare like with like.

Free · no sign-in · sources on the page

What will CMMC cost you?

Four answers and you have a three-year range: DoD's own assessment figures from the CMMC Program final rule, plus what closing your open NIST 800-171 requirements takes at the rule's labor rates. The breakdown, line by line with page numbers, arrives by email.

What a result proves: which part of the cost is DoD's (the assessment), which part is yours (the gap), and what a deliberately small boundary changes. Not a quote; a quote follows a verified readiness assessment.

What does your contract require?Level 1Federal Contract Information only; 17 practices, self-assessed every year.Level 2, self-assessmentCUI on your systems. The path in force today: Phase II certification assessments were suspended on 13 July 2026.Level 2, C3PAO certificationDoD's estimate for when certification assessments resume; confirm current status at dodcio.defense.gov/CMMC.Level 3A DIBCAC assessment on top of a Level 2 certification. Rare; the rule prices only the increment.

Business sizeSmallUnder your NAICS size standard (13 CFR 121.201). The rule assumes you outsource some IT.Other than smallThe rule assumes a larger team and a more complex environment.

How much of NIST 800-171 is in place today?Most of itAbout 10 of the 110 still open.About halfAbout 40 open.Not muchAbout 80 open.Starting from nothingAll 110 open.

Not sure? Mark the 110 in the calculator and this page will use your marks.

Two details The remediation work will be done by an outside provider, not our own staff. We already have a current System Security Plan.

Three-year estimate · Level 2 self-assessment

$99,100 to $193,990

doing the remediation with your own staff, plus the assessment DoD priced

Assessment and affirmations, DoD's estimate: $37,196; Verbatim from the CMMC Program final rule, 89 FR 83178 (Tables 9 and 10)
Closing 40 open requirements: $61,904 to $156,794; 578 to 1,464 hours at $107/h. MacTech's assumption, not DoD's: 24 to 60 hours per 5-point requirement, 16 to 40 per 3-point, 6 to 16 per 1-point, priced at the rule's own labor rates. DoD did not estimate this cost at all.
The same three years with a MacTech enclave: $151,653 to $175,429; The managed vault carries 31 of your open requirements in the technical families; 9 policy and people requirements still take hours. Packages at today's catalog prices, 2026-09-19.

Sources: CMMC Program final rule, 32 CFR part 170, 89 FR 83092 (15 October 2024), 89 FR 83178 (Tables 9 and 10) and 89 FR 83180 (Tables 12 and 13). The rule states that implementing FAR 52.204-21 and NIST SP 800-171 is “already required” and “not accounted for in this cost estimate” (89 FR 83179); the DFARS interim rule, 85 FR 61505 at 61514 (29 September 2020) made the same assumption. Everything above the assessment figure is MacTech's model.

What the numbers rest on

How much does CMMC Level 2 certification cost?: DoD's own estimate in the CMMC Program final rule is $104,670 over three years for a small entity and $117,768 for other than small (89 FR 83178 (Tables 9 and 10)), covering planning, the assessment itself including the C3PAO fee, reporting and three annual affirmations. That figure deliberately excludes the cost of implementing NIST SP 800-171, which the rule treats as an existing DFARS 252.204-7012 obligation; the estimator above adds that part from your own open requirements.
How much does a Level 2 self-assessment cost?: $37,196 over three years for a small entity and $48,827 for other than small, per the same tables. Since the suspension of CMMC Phase II on 13 July 2026, the self-assessment is the Level 2 path contracting officers can require today.
Why do other CMMC cost calculators ask for my email before showing a number?: Because the number is the thing they are selling. Ours shows the range on the page and emails the line items, the hours, the rates and the sources; you can check every figure against the Federal Register.
Is a CUI enclave cheaper than treating the whole company as in scope?: Usually, and the estimator shows why rather than asserting a percentage: a managed enclave carries the technical control families (access, audit, configuration, identification, media, communications and integrity protection) as inherited or system-enforced controls, so the hours you still spend are on the policy and people requirements. The enclave path prices MacTech's packages at today's catalog prices beside the in-house path so you can compare like with like.

Primary source: CMMC Program final rule, 32 CFR part 170, 89 FR 83092 (15 October 2024). The assessment tables are at 89 FR 83178 (Tables 9 and 10); the labor rates at 89 FR 83180 (Tables 12 and 13); the exclusion of implementation cost at 89 FR 83179.

What will CMMC cost you?

Email me the line-item breakdown

What the numbers rest on

Working notes on what it costs